Showing 1–12 of 121 articles
Page 1 of 11
How to write a security note people can trust
A useful security note makes its claims checkable and its next step clear. State what is known, identify the source, label uncertainty, and tell the reader who needs to do what.
Read the visual guide
Re-check a payment limit at the moment you pay
A limit checked before a payment can become stale while other requests are processed. Enforce the business rule at the transaction boundary, including concurrent actions and retries.
Read the visual guide
Check the SaaS settings you assumed were safe
A business subscription does not automatically select the right sharing and access controls. Define the intended configuration, review administrators and integrations, and test the user experience.
Read the visual guide
Check who is allowed to call your webhook
A webhook’s payload and familiar endpoint name do not prove who sent it. Validate the sender using its supported scheme, handle retries deliberately, and authorize the resulting business action.
Read the visual guide
Do not put a secret API key inside a mobile app
An application you distribute to users cannot reliably hide a shared secret embedded in its code or resources. Put privileged authorization behind an appropriate server-side boundary.
Read the visual guide
Keep a list of the remote admin tools you allow
A legitimate support tool still creates an access path. Record the tool, managed systems, operators, authentication, session records, and how access is removed.
Read the visual guide
What a security finding should contain
A useful finding gives its owner enough information to understand and verify the problem. Identify the affected asset, safe evidence, practical consequence, and a correction with a clear completion test.
Read the visual guide
Security numbers that tell you whether the work is happening
A meaningful metric has a defined population, a clear calculation, and evidence behind it. Choose measures that help someone decide whether an important control is working.
Read the visual guide
What to put in an evidence pack for a lawyer
An evidence pack should let an authorized legal reviewer understand the sources, timeline, handling, and gaps. Ask counsel to direct legal scope and distribution while keeping the technical record clear.
Read the visual guide
How to show that you deleted someone’s data
A completed deletion ticket is not proof that every copy was removed. Record the systems searched, actions taken, justified retention, and how backups or restoration affect the result.
Read the visual guide
What to check after you turn DMARC on
Publishing a DMARC record starts an ongoing process. Verify legitimate mail streams, review alignment failures, and make onboarding new senders part of normal change control.
Read the visual guide
Passwords that are still in Git history
Deleting a secret from the latest version does not invalidate it or remove every earlier copy. Contain the credential first, then assess repository history and any evidence of use.
Read the visual guide